diff options
| -rw-r--r-- | README.protocols | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/README.protocols b/README.protocols index 27d8c6408..1c77df15b 100644 --- a/README.protocols +++ b/README.protocols @@ -8,7 +8,7 @@ TCP 172.16.253.130:2021 <-> 75.147.140.249:443 [VLAN: 0][proto: 91/SSL][28 pkts/ TCP 172.16.253.130:2077 <-> 77.247.181.163:443 [VLAN: 0][proto: 91/SSL][136 pkts/94329 bytes][SSL client: www.fk4pprq42hsvl2wey.com] It can be detected by analyzing the SSL client certificate and checking the name that does not match to a real host in -addition of begin a bit weird. As doing DNS resolution is not a task for nDPI we let applications do and then recognize +addition of being a bit weird. As doing DNS resolution is not a task for nDPI we let applications do and then recognize SSL-tunnelled connections. See http://www.netresec.com/?page=Blog&month=2013-04&post=Detecting-TOR-Communication-in-Network-Traffic |